man rc.conf
/firewall
firewall_enable
(bool) Set to NO if you do not want have firewall rules
loaded at startup, or YES if you do. If set to YES, and
the kernel was not built with IPFIREWALL, the ipfw kernel
module will be loaded. See also ipfilter_enable.
firewall_script
(str) If you want to run a firewall script other than
/etc/rc.firewall, set this variable to the full path to
that script.
firewall_type
(str) Names the firewall type from the selection in
/etc/rc.firewall, or the file which contains the local
firewall ruleset. Valid selections from /etc/rc.firewall,
are ''open'' - unrestricted IP access; ''closed'' - all IP
services disabled, except via lo0; ''client'' - basic pro-
tection for a workstation; ''simple'' - basic protection
for a LAN. If a filename is specified, the full path must
be given.

firewall_logging
(bool) Set to YES to enable ipfw event logging. This is
equivalent to the IPFIREWALL_VERBOSE kernel option.
tcp_extensions
(bool) Set to NO by default. Setting this to YES enables
certain TCP options as described by RFC 1323. If you have
problems with connections randomly hanging or other weird
behavior of such nature, you might try setting this back to
NO and seeing if that helps. Some hardware/software out
there is known to be broken with respect to these options.
log_in_vain (bool) Set to NO by default. Setting to YES
will enable logging of connection attempts to ports that have
no listening socket on them.
tcp_keepalive
(bool) Set to YES by default. Setting to NO will disable
probing idle TCP connections to verify that the peer is
still up and reachable.
tcp_drop_synfin
(bool) Set to NO by default. Setting to YES will cause the
kernel to ignore TCP frames that have both the SYN and FIN
flags set. This prevents OS fingerprinting, but may break
some legitimate applications. This option is only avail-
able if the kernel was built with the TCP_DROP_SYNFIN op-
tion.

tcp_restrict_rst
(bool) Set to NO by default. Setting to YES will cause the
kernel to refrain from emitting TCP RST frames in response
to invalid TCP packets (e.g., frames destined for closed
ports). This option is only available if the kernel was
built with the TCP_RESTRICT_RST option.
icmp_drop_redirect
(bool) Set to NO by default. Setting to YES will cause the
kernel to ignore ICMP REDIRECT packets.
icmp_log_redirect
(bool) Set to NO by default. Setting to YES will cause the
kernel to log ICMP REDIRECT packets. Note that the log
messages are not rate-limited, so this option should only
be used for troubleshooting your own network.